7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

General

Target

svchost_dump_SCY - Copy.exe
Size

5.2MB
MD5

5fd3d21a968f4b8a1577b5405ab1c36a
SHA1

710e5ab0fceb71b982b966c3a7406ebdf1d2aa82
SHA256

7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f
SHA512

085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f
SSDEEP

98304:jgoX+R+gW1CkQFBAFGspWvuL136BRiGQiiyBrDbnh57cpbJLyns:coXxFGWL56BVrDbn77cjIs

Score

10^/10

Malware Config

Signatures

Detects BazaLoader malware 9 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

Processes:

resource	yara_rule
behavioral1/memory/2060-0-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
C:\Windows\system\svchost.exe	BazaLoader
behavioral1/memory/2044-35-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/memory/2060-33-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
C:\Windows\system\svchost.exe	BazaLoader
\Windows\system\svchost.exe	BazaLoader
\Windows\system\svchost.exe	BazaLoader
behavioral1/memory/2060-37-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/memory/2044-80-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader

Modifies Windows Firewall 1 TTPs 4 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

2640 netsh.exe
2876 netsh.exe
1964 netsh.exe
1928 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2044 svchost.exe
Loads dropped DLL 2 IoCs

Processes:

svchost_dump_SCY - Copy.exe

pid process

2060 svchost_dump_SCY - Copy.exe
2060 svchost_dump_SCY - Copy.exe

pid	process
2640	netsh.exe
2876	netsh.exe
1964	netsh.exe
1928	netsh.exe

pid	process
2044	svchost.exe

pid	process
2060	svchost_dump_SCY - Copy.exe
2060	svchost_dump_SCY - Copy.exe

Drops file in Windows directory 4 IoCs

Processes:

svchost_dump_SCY - Copy.exesvchost.exe

description	ioc	process
File created	C:\Windows\System\xxx1.bak	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File opened for modification	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2756 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exesvchost_dump_SCY - Copy.exepowershell.exepowershell.exe

pid process

3040 powershell.exe
2612 powershell.exe
2060 svchost_dump_SCY - Copy.exe
1624 powershell.exe
108 powershell.exe

pid	process
2756	schtasks.exe

pid	process
3040	powershell.exe
2612	powershell.exe
2060	svchost_dump_SCY - Copy.exe
1624	powershell.exe
108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3036	WMIC.exe
Token: SeSecurityPrivilege	3036	WMIC.exe
Token: SeTakeOwnershipPrivilege	3036	WMIC.exe
Token: SeLoadDriverPrivilege	3036	WMIC.exe
Token: SeSystemProfilePrivilege	3036	WMIC.exe
Token: SeSystemtimePrivilege	3036	WMIC.exe
Token: SeProfSingleProcessPrivilege	3036	WMIC.exe
Token: SeIncBasePriorityPrivilege	3036	WMIC.exe
Token: SeCreatePagefilePrivilege	3036	WMIC.exe
Token: SeBackupPrivilege	3036	WMIC.exe
Token: SeRestorePrivilege	3036	WMIC.exe
Token: SeShutdownPrivilege	3036	WMIC.exe
Token: SeDebugPrivilege	3036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3036	WMIC.exe
Token: SeRemoteShutdownPrivilege	3036	WMIC.exe
Token: SeUndockPrivilege	3036	WMIC.exe
Token: SeManageVolumePrivilege	3036	WMIC.exe
Token: 33	3036	WMIC.exe
Token: 34	3036	WMIC.exe
Token: 35	3036	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3036	WMIC.exe
Token: SeSecurityPrivilege	3036	WMIC.exe
Token: SeTakeOwnershipPrivilege	3036	WMIC.exe
Token: SeLoadDriverPrivilege	3036	WMIC.exe
Token: SeSystemProfilePrivilege	3036	WMIC.exe
Token: SeSystemtimePrivilege	3036	WMIC.exe
Token: SeProfSingleProcessPrivilege	3036	WMIC.exe
Token: SeIncBasePriorityPrivilege	3036	WMIC.exe
Token: SeCreatePagefilePrivilege	3036	WMIC.exe
Token: SeBackupPrivilege	3036	WMIC.exe
Token: SeRestorePrivilege	3036	WMIC.exe
Token: SeShutdownPrivilege	3036	WMIC.exe
Token: SeDebugPrivilege	3036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3036	WMIC.exe
Token: SeRemoteShutdownPrivilege	3036	WMIC.exe
Token: SeUndockPrivilege	3036	WMIC.exe
Token: SeManageVolumePrivilege	3036	WMIC.exe
Token: 33	3036	WMIC.exe
Token: 34	3036	WMIC.exe
Token: 35	3036	WMIC.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeIncreaseQuotaPrivilege	1680	WMIC.exe
Token: SeSecurityPrivilege	1680	WMIC.exe
Token: SeTakeOwnershipPrivilege	1680	WMIC.exe
Token: SeLoadDriverPrivilege	1680	WMIC.exe
Token: SeSystemProfilePrivilege	1680	WMIC.exe
Token: SeSystemtimePrivilege	1680	WMIC.exe
Token: SeProfSingleProcessPrivilege	1680	WMIC.exe
Token: SeIncBasePriorityPrivilege	1680	WMIC.exe
Token: SeCreatePagefilePrivilege	1680	WMIC.exe
Token: SeBackupPrivilege	1680	WMIC.exe
Token: SeRestorePrivilege	1680	WMIC.exe
Token: SeShutdownPrivilege	1680	WMIC.exe
Token: SeDebugPrivilege	1680	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1680	WMIC.exe
Token: SeRemoteShutdownPrivilege	1680	WMIC.exe
Token: SeUndockPrivilege	1680	WMIC.exe
Token: SeManageVolumePrivilege	1680	WMIC.exe
Token: 33	1680	WMIC.exe
Token: 34	1680	WMIC.exe
Token: 35	1680	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1680	WMIC.exe
Token: SeSecurityPrivilege	1680	WMIC.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

svchost_dump_SCY - Copy.exesvchost.exe

description	pid	process	target process
PID 2060 wrote to memory of 3036	2060	svchost_dump_SCY - Copy.exe	WMIC.exe
PID 2060 wrote to memory of 3036	2060	svchost_dump_SCY - Copy.exe	WMIC.exe
PID 2060 wrote to memory of 3036	2060	svchost_dump_SCY - Copy.exe	WMIC.exe
PID 2060 wrote to memory of 2640	2060	svchost_dump_SCY - Copy.exe	netsh.exe
PID 2060 wrote to memory of 2640	2060	svchost_dump_SCY - Copy.exe	netsh.exe
PID 2060 wrote to memory of 2640	2060	svchost_dump_SCY - Copy.exe	netsh.exe
PID 2060 wrote to memory of 2876	2060	svchost_dump_SCY - Copy.exe	netsh.exe
PID 2060 wrote to memory of 2876	2060	svchost_dump_SCY - Copy.exe	netsh.exe
PID 2060 wrote to memory of 2876	2060	svchost_dump_SCY - Copy.exe	netsh.exe
PID 2060 wrote to memory of 3040	2060	svchost_dump_SCY - Copy.exe	powershell.exe
PID 2060 wrote to memory of 3040	2060	svchost_dump_SCY - Copy.exe	powershell.exe
PID 2060 wrote to memory of 3040	2060	svchost_dump_SCY - Copy.exe	powershell.exe
PID 2060 wrote to memory of 2612	2060	svchost_dump_SCY - Copy.exe	powershell.exe
PID 2060 wrote to memory of 2612	2060	svchost_dump_SCY - Copy.exe	powershell.exe
PID 2060 wrote to memory of 2612	2060	svchost_dump_SCY - Copy.exe	powershell.exe
PID 2060 wrote to memory of 1468	2060	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 1468	2060	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 1468	2060	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 2756	2060	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 2756	2060	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 2756	2060	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 2044	2060	svchost_dump_SCY - Copy.exe	svchost.exe
PID 2060 wrote to memory of 2044	2060	svchost_dump_SCY - Copy.exe	svchost.exe
PID 2060 wrote to memory of 2044	2060	svchost_dump_SCY - Copy.exe	svchost.exe
PID 2044 wrote to memory of 1680	2044	svchost.exe	WMIC.exe
PID 2044 wrote to memory of 1680	2044	svchost.exe	WMIC.exe
PID 2044 wrote to memory of 1680	2044	svchost.exe	WMIC.exe
PID 2044 wrote to memory of 1964	2044	svchost.exe	netsh.exe
PID 2044 wrote to memory of 1964	2044	svchost.exe	netsh.exe
PID 2044 wrote to memory of 1964	2044	svchost.exe	netsh.exe
PID 2044 wrote to memory of 1928	2044	svchost.exe	netsh.exe
PID 2044 wrote to memory of 1928	2044	svchost.exe	netsh.exe
PID 2044 wrote to memory of 1928	2044	svchost.exe	netsh.exe
PID 2044 wrote to memory of 1624	2044	svchost.exe	powershell.exe
PID 2044 wrote to memory of 1624	2044	svchost.exe	powershell.exe
PID 2044 wrote to memory of 1624	2044	svchost.exe	powershell.exe
PID 2044 wrote to memory of 108	2044	svchost.exe	powershell.exe
PID 2044 wrote to memory of 108	2044	svchost.exe	powershell.exe
PID 2044 wrote to memory of 108	2044	svchost.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
2⤵
- Modifies Windows Firewall
PID:2640

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
2⤵
- Modifies Windows Firewall
PID:2876

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "Timer"
2⤵
PID:1468

C:\Windows\system32\schtasks.exe
schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
2⤵
- Creates scheduled task(s)
PID:2756

C:\Windows\System\svchost.exe
"C:\Windows\System\svchost.exe" formal
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
- Modifies Windows Firewall
PID:1964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
- Modifies Windows Firewall
PID:1928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:108

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
75ef91188e430aba34e5427bf534618f

SHA1
830c3d29594eae456d259e193ae47aa045b9486f

SHA256
838a7d955be4fbf5466b0c184b5021c3f6791bc57253c2e00f785768ba5b0bb0

SHA512
d5cb95b842ae57cb81ebfbfb530edbd281d068e1334d663bb7f83492eca4b59811d17fa4b2cb291d512d95f7ba6b67dadf93cdb6ebdad50eb658a0a772d39494

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Filesize
2.7MB

MD5
1a54941e69d95e9a46d184486f32ff9f

SHA1
fa94366a0032895f00742ef06e5663c888245847

SHA256
2553820f11ff6d383401860b42b7ce8168950d72a9cef7434dfd4b372f0a10da

SHA512
ddbdefd03d9d669c4e958542be9b87ed05c83289c17f4364858b4d412c7d91946d0b1f97e9279edded849d012b2e8bbc9db8af32bf32a22d8466d7caf253727b

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Filesize
2.5MB

MD5
1528f0ebb080f1b74256588e8524a332

SHA1
38070f730d23adf9610abdc9a3e0b13277b12b38

SHA256
1e8e3f8d734f0231e66712969a4085524282d963a63c4c640fbcd18efee3f74c

SHA512
578df244868090ef96ab6f6482e36ab1d960385ccbbbbf2b42ee2e59e020f3008a7ab36e4b5bb8dd9859bf31b3a35d7644254e80165b14112048c5992c03dfd0

Download Submit
C:\Windows\system\svchost.exe
Filesize
236KB

MD5
2aecbf1749a77caa002df331f00e089d

SHA1
af2d9e19d3956b04d8324b090747803e86331820

SHA256
5a2cf0f6f7db237679324b1b6156a11a367d60d17a81a8abfd57707adc801d57

SHA512
0ea13eb2902ccc39c26c927d4ae7a7cb4dde1566ee3de0691798948e078beef464228dcdb8c972bf0b9f7e1845ec3fd92473f04cbec0f41f5feba8f0a0a4bf71

Download Submit
C:\Windows\system\svchost.exe
Filesize
53KB

MD5
44a18a591accd89ac012ac1d48c6e367

SHA1
a4d2988e1504f13661682aeca813c96f7b6a0109

SHA256
f9886644101c4967d410231a961843d35818d1086e105f6672a8e8107ce1e0a9

SHA512
10473e286fa6300c6a096b5e726cae00c409e30d59fd7fa7c40a71786c197a92164c97fc4b7295eb61839a030711c96d1797b140320e1d79dd8d45a901c4ecfa

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\system\svchost.exe
Filesize
152KB

MD5
86a73dd116657cbd0c6ad815d48beea8

SHA1
c11f9269f9465a388459caa9d5a83b18294a199e

SHA256
d9d1b0d7191ee2be4a8d6a5689eadc1250bebe80f539652063ec31d8c832d505

SHA512
efdae5eb03afd622b3cf118e778413dded0355b3241da6008ebc2e86ebf44e2e4eed12c236758396b36593981fb093890802e77c492cd3e381c8520cfbad0fa6

Download Submit
\Windows\system\svchost.exe
Filesize
292KB

MD5
3fec225f8cdd4f87a721aafd61ebbd79

SHA1
63e6834ca1f8c8de94d2c28a88ea94ea45c2fa38

SHA256
eba7bf216f5728981e0cb3abb15deffdbe1a36da72085e3fc48d4a302ca553af

SHA512
0a8d10f8c5fa4c555523467011a678f4e09e7820a5e7f342845015f2009e47e2807afec0d02316e9fbf680fb2a530a6e286fcf71f42247a62bce8d962ef5aa96

Download Submit
memory/108-63-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/108-57-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/108-55-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/108-58-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/108-64-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/108-60-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/108-56-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/1624-59-0x0000000002964000-0x0000000002967000-memory.dmp

Filesize
12KB

Download
memory/1624-47-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/1624-61-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/1624-53-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/1624-45-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/1624-48-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/1624-46-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/1624-44-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/1624-62-0x000000000296B000-0x00000000029D2000-memory.dmp

Filesize
412KB

Download
memory/2044-35-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2044-80-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2044-65-0x000000001ECF0000-0x000000001F1D2000-memory.dmp

Filesize
4.9MB

Download
memory/2060-33-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2060-37-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2060-0-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/2060-36-0x0000000040AF0000-0x0000000041126000-memory.dmp

Filesize
6.2MB

Download
memory/2060-34-0x0000000040AF0000-0x0000000041126000-memory.dmp

Filesize
6.2MB

Download
memory/2612-23-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2612-20-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-19-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2612-21-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-17-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-22-0x0000000002D3B000-0x0000000002DA2000-memory.dmp

Filesize
412KB

Download
memory/3040-18-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-15-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-13-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/3040-12-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-16-0x000000000295B000-0x00000000029C2000-memory.dmp

Filesize
412KB

Download
memory/3040-14-0x0000000002954000-0x0000000002957000-memory.dmp

Filesize
12KB

Download
memory/3040-6-0x0000000002A10000-0x0000000002A18000-memory.dmp

Filesize
32KB

Download
memory/3040-5-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads